CVE-2019-5444

Path traversal vulnerability in version up to v1.1.3 in serve-here.js npm module allows attackers to list any file in arbitrary folder...

Path traversal

Path traversal vulnerability in version up to v1.1.3 in serve-here.js npm module allows attackers to list any file in arbitrary folder...

CVE-2019-5444

Path traversal vulnerability in version up to v1.1.3 in serve-here.js npm module allows attackers to list any file in arbitrary folder...

CVE-2019-5444

CVE-2019-5444 refers to a path traversal vulnerability in the npm module serve-here.js prior to version 1.2.0 (reported with version 1.1.3). The issue arises because the package does not sanitize URL paths, allowing an attacker to access files outside the served folder by using relative paths (e....

PT-2019-17673 · Unknown · Serve-Here.Js

Name of the Vulnerable Software and Affected Versions: serve-here.js versions prior to 1.2.0 Description: The issue allows attackers to list any file in an arbitrary folder due to a path traversal vulnerability. This is caused by the package's failure to sanitize URLs, enabling attackers to acces...

GHSA-G8M7-QHV7-9H5X Path Traversal in serve-here.js

Versions of serve-here.js prior to 1.2.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths. Recommendation Upgrade to version 1.2.0 or later...

Path Traversal in serve-here.js

Versions of serve-here.js prior to 1.2.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths. Recommendation Upgrade to version 1.2.0 or later...

Directory Traversal

serve-here.js is vulnerable to directory traversal. The attack is possible as it allows adding ../ to the web root, listing any file in another folder of web root...

Path Traversal

Overview Versions of serve-here.js prior to 1.2.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths. Recommendation Upgrade to version 1.2.0 or later. References - HackerOne Report...

Path Traversal

Overview Versions of serve prior to 7.0.1 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through if the path contains a /./, which allows attackers to access hidden folders and files. Recommendation Upgrade to version 7.0.1 or later. References - HackerOne Report -...

Directory Traversal

serve-handler is vulnerable to directory traversal. Attackers are able to access explicitly ignored folders using directory traversal characters ../ followed by the ignored folders. This vulnerability is a bypass of the fix for CVE-2018-3718...

Cross-Site Scripting

Overview Versions of serve prior to 10.0.2 are vulnerable to Cross-Site Scripting XSS. The package does not encode output, allowing attackers to execute arbitrary JavaScript in the victim's browser if user-supplied input is rendered. Recommendation Upgrade to version 10.0.2 or later. References -...

Path Traversal

Overview Versions of serve prior to 10.1.2 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through relative paths, which allows attackers to access hidden folders and files. Recommendation Upgrade to version 10.1.2 or later. References - HackerOne Report - GitHub...

Node.js third-party modules: [serve-here.js] List any file in the folder by using path traversal.

I would like to report Path Traversal in serve-here.js. It allows to list any file in another folder of web root. Module module name: serve-here.js version: 1.1.3 npm page: https://www.npmjs.com/package/serve-here.js Module Description Serve static files over HTTP Vulnerability Vulnerability...

Information Disclosure

serve-handler is vulnerable to information disclosure attacks. The vulnerability exists as symlinks were enabled by default, and were being resolved during runtime...

Information Exposure

Overview org.webjars.npm:serve-handler is a package responsible for routing requests and handling responses. Affected versions of this package are vulnerable to Information Exposure. The unlisted property removes the file/folder from directory list but still allows viewing them by visiting their...

Directory Traversal

Overview Versions of serve before 7.1.3 are vulnerable to Directory Traversal. File paths are not sanitized leading to unauthorized access of system files. Recommendation Upgrade to version 7.1.3 or later References - HackerOne Report - GitHub Advisory...

Directory Traversal in serve

Versions of serve before 7.1.3 are vulnerable to Directory Traversal. File paths are not sanitized leading to unauthorized access of system files. Recommendation Upgrade to version 7.1.3 or later...

GHSA-V588-QCP3-JV46 Path Traversal in serve

Versions of serve prior to 7.0.1 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through if the path contains a /./, which allows attackers to access hidden folders and files. Recommendation Upgrade to version 7.0.1 or later...

Path Traversal in serve

Versions of serve prior to 7.0.1 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through if the path contains a /./, which allows attackers to access hidden folders and files. Recommendation Upgrade to version 7.0.1 or later...